RBS 2011 Annual Report Download - page 239

RBS Group 2011 237
Governance, structure and risk appetite
Governance and structure
Group Operational Risk is an independent function reporting to the
Deputy Group Chief Risk Officer. Group Operational Risk is responsible
for the design and maintenance of the operational risk policy standards
(ORPS).
The ORPS are incorporated in the Group Policy Framework (GPF), they
provide the direction for delivering effective operational risk management
and are designed to allow the consistent identification, assessment,
management, monitoring and reporting of operational risk across the
Group.
The Operational Risk Executive Committee which was formed in January
2011, oversees the operational risk framework and profile of the Group in
line with the agreed risk appetite. It provides guidance, oversight and
advice. It also escalates and reports any issues or areas of concern to
the Board Risk Committee and to other senior committees.
Risk appetite
The Group’s operational risk appetite statement is agreed by the Group
Board. It comprises a number of specific measures of risk, such as:
xthe maximum operational risk losses the Group is prepared to
accept. This is expressed as a percentage of the Group’s estimated
gross income for the year ahead; or
xthe value of a single extreme but plausible operational impact.
These are identified and assessed through the scenario analysis
programme (refer to Scenario analysis below).
To ensure the Group operates within the set risk appetite, the high-level
statements are supplemented by specific tolerances for different types of
operational risk. The GPF sets out how to manage risk within acceptable
limits, which in turn enables the Group to operate within the overall risk
appetite and the specific tolerances. The Group has a zero tolerance for
risks such as breaches of laws and regulations.
Operational risk cycle and key management tools
The operational risk cycle comprises four stages:
xIdentification of risks;
xAssessment or measurement of the scale of risks;
xManagement or control of risks to prevent their recurrence or
minimise the potential impact; and
xMonitoring and reporting of risks.
Although the operational risk tools encompass all stages of the risk cycle,
they can be broadly categorised as follows:
Identification and assessment
Risk and control assessments
Controls that are effective without being excessive ensure the Group
retains its reputation for efficient customer service and security. Risk and
control assessments are used to identify and assess material operational
risks and key controls across all business areas. The process is designed
to ensure that risks are effectively managed in line with stated risk
appetite, prioritised and documented. Controls are tested frequently with
aview to ensuring they remain fit for purpose and operate effectively. The
Group’s risk assessment methodology was enhanced during 2011 to
ensure a more consistent approach to identifying risks and their
associated controls and measuring expected loss. Risk assessments
consider the new firm-wide taxonomy and will soon be captured in the
Group-wide repository for operational risk.
Risk assessments are often conducted in a workshop environment,
bringing together subject matter experts from across the division and key
functions. By sharing expertise, they can identify improvements to risk
identification, measurement and control. Risk governance is reviewed
regularly ensuring that there is clarity and ownership of key risk areas.
Through coming together and sharing knowledge, participants gain a
broader understanding of how their work fits together.
Group new product approval process
The Group’s new product approval process ensures there is a consistent
process to identify, assess and approve the risks associated with new
products.
Following the conclusion of reviews conducted during 2011,
enhancements will be made during 2012 to the product governance
forums, to provide earlier engagement between the business, Group and
divisional risk teams and subject matter experts when assessing whether
the risks associated with new products are in line with appetite. The
forums will be supported by an upgrade to the Group’s key tools used to
manage and report on new product approval.
Scenario analysis
Scenario analysis is used to assess the possible impact of extreme but
plausible operational risk loss events. It provides a forward-looking basis
for managing exposures beyond the Group's risk appetite. The
methodology provides a structured and consistent approach to scenario
scoping and measurement. A significant portfolio of scenarios was
developed in 2011 across divisions, covering material risks to which the
Group is exposed. Group-wide scenarios are centrally scoped and
workshops are facilitated by Group Operational Risk in conjunction with
functions and policy owners, before being assessed by divisions to derive
specific impact estimates. This also allows the Group to review
operational risk impacts as they arise from macroeconomic stresses (e.g.
eurozone distress) in a time-efficient and effective manner.